Critical UEFI firmware flaw threatens most of the world's servers
A critical vulnerability, CVE-2026-97631, has been found in the open-source EDK II code used to build UEFI firmware, allowing malicious code to run before the operating system loads. Details leaked before the planned disclosure date, and patching is expected to be slow.
A critical security vulnerability has been found in TianoCore EDK II, an open-source codebase that most of the world's server makers and data centers use to build UEFI firmware, the software that runs when a computer starts up, before the operating system. The flaw, tracked as CVE-2026-97631, has a severity rating of 9.5 out of 10 and lets attackers execute malicious code at the earliest stage of booting.
What the flaw is
The bug is a memory-corruption error in an ICMP (network error messaging protocol) component within the PXE Base Code driver, which lets servers and other devices boot from code downloaded over a local network. The driver does not enforce a 504-byte copy limit, so an oversized error message overwrites adjacent data. The flaw has existed in the code for 16 years.
The injected code runs before Secure Boot and other defenses that build a chain of trust, including the Trusted Platform Module (TPM), come into play. The resulting payload runs only once and does not persist, but it can help attackers install other malicious components.
Early disclosure
The flaw was found by Alex Matrosov of Anthropic and Dan Holmes of Google, with coordinated disclosure planned for January. AMI, a maker of motherboards and other hardware, published a pull request last month describing the bug and including a fix. TianoCore Project members then issued a public advisory last week. With the patch code public, advanced attackers can more easily build working exploits.
Limits and advice
Exploitation requires some level of access to the local network, and the attacker must know the target's firmware build. Home and small-office users who boot only from disk drives are not affected. Intel said none of its commercial products under security support are known to be affected, while Arm said the flaw is not directly applicable to its product portfolio. AMD, Phoenix, AMI, Microsoft and Amazon did not answer questions.
Affected organizations are advised to contact their firmware vendor, consider temporarily disabling network boot where possible, and monitor logs for signs of exploitation attempts.
